HTML form to email PHP

An html form to email php script is the oldest answer in the tutorials: a file named send.php calls mail(), and the form's action points at that file. It works on a host that runs PHP and that allows outbound mail. A lot of current sites are not on that host. This note shows the script, the parts that fail quietly, and the same form without PHP.

The script people copy

<?php
$name = $_POST['name'] ?? '';
$email = $_POST['email'] ?? '';
$message = $_POST['message'] ?? '';
$to = 'you@example.com';
$subject = 'Contact form';
$body = "Name: $name\nEmail: $email\n\n$message";
$headers = "From: you@example.com\r\nReply-To: $email";
mail($to, $subject, $body, $headers);
header('Location: /thanks.html');

The form is ordinary HTML.

<form action="/send.php" method="POST">
  <input name="name" />
  <input type="email" name="email" />
  <textarea name="message"></textarea>
  <button type="submit">Send</button>
</form>

On a traditional cPanel host this delivers, until the host's mail IP is listed for spam and the messages start vanishing. mail() returning true only means the local mail transfer agent accepted the message. It does not mean a person read it.

Where the copy-paste version breaks

The reply-to is taken from the visitor and placed in a header. A value that contains a newline can add headers you did not write. Strip newlines, and accept the address only when it is one address. The sample above does neither.

There is no honeypot, no pause between posts, and no monthly ceiling. The first script that finds send.php will post all night. Your host will then throttle the whole account, including mail you wanted.

The script trusts every field. A file upload, if you add one later, needs a size cap and a type allow-list. The sample stores nothing, so a failed mail() is invisible. The visitor saw a redirect. You saw an empty inbox.

Static hosts make a sharper cut. A page on a file host, a pages host, or an object store has no PHP process. Uploading send.php next to index.html does not create one. The form action 404s, or the host offers the file as a download. That is the usual end of an html form to email php plan on a modern brochure site.

The same form, without the script

Point action at https://getformpost.com/api/submit and add a hidden access key from your dashboard. The sample below is the html form to email php file people still paste, with the hosted action in its place. Keep the field names. Add a hidden honeypot named botcheck. Save the thank-you URL in the inbox instead of calling header(). The endpoint rejects a redirect that the form tries to choose for itself, strips header newlines, and stores the row even when mail fails.

<form action="https://getformpost.com/api/submit" method="POST">
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY" />
  <input
    type="text"
    name="botcheck"
    style="display:none"
    tabindex="-1"
    autocomplete="off"
  />
  <input name="name" required />
  <input type="email" name="email" required />
  <textarea name="message" required></textarea>
  <button type="submit">Send</button>
</form>

You still write the HTML. You do not operate the mail agent. The website contact form page is that product. The form to email page states the delivery rules in one place. The submit form to email note is the request contract if a script, not a browser, is doing the POST.

When PHP is still the right tool

Keep PHP when the form must do something the endpoint will not do: write a row in a database you already run, charge a card, or attach a checked file to an internal workflow. In that case call a mail API from the server, validate the address, and keep the honeypot. Do not shell out to mail() on a shared host and hope.

Treat an html form to email php file as optional, not as the default for a folder of HTML. Do not keep PHP only because an old article used it. If the site is a folder of HTML, an html form to email php file is a second system you now have to patch. One endpoint, one key, and a dashboard you can open when a message seems missing is the smaller system.

The free cap is 100 submissions a month. The paid cap is on the free contact form page. A PHP script has no cap until the host imposes one, which is a worse moment to learn about limits. Read the html contact form send to email guide if you want the field-by-field version of the hosted form before you delete send.php.